T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:33- Finding
Unverified Remote Installer Is Downloaded and Executed Directly
- Content
View full analysis
/dev/null; then echo "cast (foundry) required. Install: curl -L https://foundry.paradigm.xyz | bash" exit 1 fi ``` ### Technical Analysis The installation guidance pipes a remote HTTP response directly into `bash`. Although the specified domain appears associated with the Foundry project, the downloaded payload is mutable and is neither pinned to a reviewed version nor verified using a cryptographic checksum or signature. Consequently, the code that users execute can differ from the content available when the Skill was audited. HTTPS protects the connection under normal conditions but does not address compromise of the hosting service, DNS or certificate infrastructure, distribution account, or upstream installer itself. This behavior is not necessary for the Skill’s core functionality. The Skill only requires a compatible `cast` executable; it does not require arbitrary remote code to be executed directly. ### Attack Path 1. A user follows the prerequisite instructions or copies the command printed by `common.sh`. 2. The user runs `curl -L https://foundry.paradigm.xyz | bash`. 3. The remote endpoint, redirect target, hosting infrastructure, or served installer has been compromised or changed maliciously. 4. The response is immediately interpreted by the user’s shell without an opportunity for inspection. 5. Attacker-controlled commands execute with the user’s privileges. 6. Those commands can access wallet files, env ...[truncated 676 chars]- Remediation
View remediation